A US-connected business processes a payment, ships goods, or closes a trade-finance transaction. Days – or months – later, it identifies a problem: a counterparty on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons), a shipment routed through a jurisdiction subject to US sanctions, or an ownership chain that triggers the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked). The compliance team escalates. The general counsel asks the question that shapes everything that follows: is this an apparent violation, and what do we do now?
An apparent violation is a transaction or activity that, on the facts available, appears to breach OFAC's prohibitions – whether or not a final enforcement determination has been made. OFAC's published enforcement guidelines set out the factors that determine whether a matter results in no action, a cautionary letter, or a civil monetary penalty. The governing authority is OFAC, operating under IEEPA and related statutory authority. How the assessment is handled in the first days after discovery materially affects the outcome.
As of April 2026, OFAC's enforcement posture rewards early, thorough, and well-documented responses. This page explains what an apparent-violation assessment involves, how the procedure works, where cross-border complexity changes the analysis, and how Calder & Vance supports clients through every stage of the process.
What is an apparent-violation assessment and who needs one?
An apparent-violation assessment is a structured legal review of whether a transaction, pattern of transactions, or business activity contravenes OFAC's prohibitions, and – if it does – how serious the exposure is. It is the first step in every enforcement-response engagement.
The assessment is needed whenever a business with US-jurisdictional exposure identifies a transaction that may have involved a blocked person, a blocked property interest, or a sanctions-restricted counterparty or territory. US-jurisdictional exposure is broader than it appears. It reaches US persons wherever located, all persons physically in the United States, entities organised under US law, and – through secondary-sanctions risk – non-US businesses that deal in US-origin goods, US-dollar clearing, or US financial institutions.
In our experience, the businesses most exposed to an undetected apparent violation are not those with the weakest programmes. They are often businesses that have invested in screening but have not stress-tested their tools against aggregated ownership, control structures, or the divergence between OFAC's lists and the EU and UK consolidated lists. A transaction that clears one screen can still be an apparent violation under a different input.
Who typically commissions an assessment? General counsel offices at multinationals when a due-diligence review surfaces a hit; compliance teams at banks or payment firms after an automated screening alert escalates to a human reviewer; exporters whose freight forwarder flags a consignee; and boards of companies that have received an OFAC administrative subpoena or an informal inquiry.
How does OFAC evaluate an apparent violation – and what factors determine the outcome?
OFAC does not treat all apparent violations the same. Its published enforcement guidelines describe a graduated approach, ranging from a finding of no action through a cautionary letter to a civil monetary penalty or – in the most serious cases – a referral to the Department of Justice for criminal prosecution.
The core analytical framework turns on two dimensions: the general factors (willfulness, concealment, harm to sanctions-programme objectives, and the nature of the subject) and the specific aggravating or mitigating factors that adjust the base penalty within a statutory range. A voluntary self-disclosure – what practitioners call a VSD (voluntary self-disclosure to a regulator) – is among the most significant mitigating factors. OFAC's guidelines provide that a timely, complete, and accurate VSD can reduce the base civil monetary penalty by a substantial proportion, though no outcome is guaranteed and the precise reduction depends on the full set of facts.
Two aggravating factors consistently appear in enforcement actions. The first is actual knowledge: a business or individual who knew the transaction was prohibited faces a materially worse outcome than one that failed through a control gap. The second is harm to programme objectives: transactions that generate economic benefit for a designated person or a sanctioned programme are treated more seriously than incidental or technical breaches.
The apparent-violation assessment must therefore answer, at minimum: What happened, precisely? Who knew, and when? Was the breach wilful, reckless, or the product of a control failure? What is the realistic penalty base? And does the VSD calculus favour disclosure?
The position above covers the standard case. Your facts – the counterparty, the goods, the regime in play, the internal knowledge at the time – change the analysis significantly.
For an initial assessment of your exposure under OFAC, contact Calder & Vance at info@caldervance.com.
What does the assessment procedure involve – step by step?
The procedure has five stages, each of which generates outputs that feed directly into any subsequent voluntary self-disclosure or penalty-mitigation submission.
- Fact-gathering and transaction reconstruction. The legal team collects all records of the relevant transaction or pattern: payment records, shipping documents, counterparty due-diligence files, screening logs, and internal communications. The objective is a complete factual chronology. Gaps in the record are themselves significant – OFAC's guidelines treat record-keeping failures as an aggravating indicator.
- Jurisdictional and nexus analysis. The team determines which OFAC programme or programmes apply, and whether the US-jurisdictional nexus is established. This is not always obvious in cross-border transactions: a non-US entity may have US-person involvement at board level, or the transaction may have cleared through a US correspondent bank, creating a jurisdictional hook.
- Sanctions-list and ownership-chain review. Every counterparty, beneficial owner, and intermediate entity is reviewed against the SDN List, the relevant OFAC programme lists, and – where a 50 percent rule question arises – the ownership chain is mapped. Aggregation across multiple listed persons is checked, because two listed persons each holding a sub-50-percent stake can together reach the threshold.
- Aggravating and mitigating factor analysis. Each of OFAC's published factors is scored against the facts. This produces a realistic range for the civil monetary penalty base and identifies which factors the response strategy should address first.
- VSD and response strategy. The team advises on whether to make a voluntary self-disclosure, and – if so – how to frame it. The VSD itself requires a thorough, accurate, and timely account of all relevant facts. An incomplete or inaccurate VSD is worse than no disclosure at all.
In a matter where the apparent violation is straightforward and the record is complete, stages one through four can be completed within a short number of business days. Complex matters – multi-party transactions, layered ownership structures, or transactions spanning multiple sanctions programmes – require additional time. We set a realistic timetable at the outset and communicate any change promptly.
How does cross-border exposure change the apparent-violation analysis?
A business that has potential OFAC exposure rarely has OFAC exposure alone. Cross-border transactions that trigger OFAC review also frequently engage OFSI in the United Kingdom, EU Council regulations, or both. The apparent-violation assessment must account for this overlap – and for the points where the regimes diverge.
Three divergences matter most in practice.
First, the ownership-and-control test. OFAC's 50 percent rule is mechanical: aggregate ownership at or above the threshold triggers the prohibition, regardless of control. OFSI and the EU apply a broader ownership and control test (the UK and EU test for whether a non-listed entity is caught through a listed person) that can capture entities where listed persons exercise significant control even at a sub-50-percent ownership level. A transaction that clears OFAC's ownership test may still be prohibited under OFSI or the relevant EU regulation.
Second, licensing and authorisation routes differ. OFAC issues specific and general licences. OFSI issues specific licences under SAMLA and the relevant thematic regulations. The EU licensing regime is administered at Member State level, with significant variation in practice between national competent authorities. If a business needs a licence to regularise a position in more than one regime, it must run parallel applications and manage potentially inconsistent outcomes.
Third, reporting obligations are not harmonised. OFAC's voluntary self-disclosure process is well-documented. OFSI has its own reporting requirements and enforcement guidance. Timing a VSD to OFAC without inadvertently triggering or complicating a parallel OFSI obligation requires careful sequencing.
In our cross-border practice, we regularly advise on matters where the OFAC assessment is the starting point and the UK or EU position is an equal or greater compliance concern. The assessment must map all three, not just the most prominent.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact our team at info@caldervance.com.
For EU apparent-violation assessments, see our EU apparent-violation assessment service. For OFSI assessments, see our OFSI apparent-violation assessment service.
What are the most common risk flags that escalate an apparent violation to a penalty?
Most apparent violations that result in significant civil penalties share a recognisable pattern. Identifying the pattern early is the purpose of the assessment.
The first risk flag is actual or constructive knowledge. OFAC's guidelines treat a business differently depending on whether it knew, should have known, or had no reason to know that the transaction was prohibited. Constructive knowledge – where the red flags were present but ignored – can be as damaging as actual knowledge in a penalty calculation. Has your compliance team documented why a screening alert was dismissed?
The second risk flag is systemic failure. A single apparent violation that reflects a one-off screening gap is treated differently from a violation that is one of a pattern. OFAC looks at the number of transactions, the time period, and whether the control failure was corrected when first identified. A business that continued processing after identifying a potential issue faces significantly aggravated exposure.
The third risk flag is concealment or obstruction. Any attempt to obscure the violation – whether by altering records, withholding documents, or providing inaccurate information to OFAC – converts a civil matter into a criminal one. The assessment must identify whether any such conduct has occurred, because the response strategy depends on it.
The fourth risk flag is harm to programme objectives. Transactions that generate direct economic benefit for a designated party – payments, revenue-sharing arrangements, asset transfers – attract the highest penalties. Technical or incidental violations that produce minimal economic harm are treated differently, but the business must be able to demonstrate, with records, that the harm was genuinely minimal.
A micro-scenario illustrates the pattern. In a recent matter, a financial-services business identified that a series of payment transactions over several months had been processed for an entity that had been added to the SDN List part-way through the relationship. The business had updated its screening tool but had not re-screened existing counterparties against the new list. We scoped the apparent violation, mapped the transactions, and prepared the voluntary self-disclosure. The response addressed the systemic gap directly and included a remediation plan. The matter resulted in a cautionary letter. No outcome of this type is guaranteed, but early, complete, and accurate engagement with OFAC consistently produces better outcomes than delay.
Common misconceptions about apparent-violation assessments
The most persistent myth in this area is that a voluntary self-disclosure automatically results in a penalty. It does not. OFAC's enforcement guidelines expressly identify a VSD as a significant mitigating factor, and a material proportion of VSD matters close without a civil monetary penalty. The question is not whether to disclose, but whether the facts, when fully understood, support disclosure – and, if so, how to frame it accurately and completely.
A second misconception is that an apparent violation only matters if OFAC discovers it first. Businesses sometimes reason that if OFAC has not contacted them, the risk is low. This misunderstands how OFAC learns of violations. Information comes from banks, from correspondent institutions, from SAR filings, from export-control referrals, and from whistleblowers. A business that has identified an apparent violation and declined to self-disclose is not invisible; it is simply waiting. The timing of a disclosure materially affects OFAC's assessment of willfulness and cooperation.
A third misconception is that small transactions carry no real risk. OFAC's civil penalties are calculated by reference to a statutory maximum per transaction, not by reference to the value of the transaction itself. A low-value payment to a blocked person can carry the same maximum penalty as a high-value one. The transaction value affects the harm analysis, but it does not cap the penalty exposure.
We regularly advise clients who have delayed action based on one of these three misconceptions. In each case, earlier engagement would have produced a cleaner and less costly resolution.
How Calder & Vance assists at each stage of an apparent-violation assessment
Our enforcement and investigations team handles apparent-violation assessments from initial triage through to the close of the OFAC review. The engagement is structured to give clients clarity at each decision point.
At the assessment stage, we scope the apparent violation, advise on voluntary self-disclosure, and prepare the penalty defence. Specifically: we reconstruct the transaction record, map the ownership and control chain against OFAC's lists, score each aggravating and mitigating factor against OFAC's published guidelines, and produce a written assessment that sets out the realistic exposure range and the recommended response.
Where a voluntary self-disclosure is appropriate, we prepare and submit it. A VSD to OFAC must be complete, accurate, and timely. We manage the submission, respond to OFAC's queries, and maintain the engagement through to the final determination.
Where a penalty response is required, we prepare the submission. The submission must address each enforcement factor directly, present the facts accurately, and make the strongest available case for a reduced or waived penalty. We have acted for businesses ranging from financial institutions to manufacturers of industrial equipment and technology companies with complex export-control overlaps.
For cross-border matters, we co-ordinate the OFAC position with the parallel UK and EU analysis. Where local counsel in the relevant jurisdiction is required, we manage that interface. Our clients receive a single, consistent view of their multi-regime exposure and a co-ordinated response strategy.
Related practices
- EU apparent-violation assessment – legal support for apparent violations under EU Council sanctions regulations
- OFSI apparent-violation assessment – legal support for apparent violations under UK financial-sanctions rules
- OFSI enforcement and investigations – broader enforcement defence and penalty-mitigation support under OFSI